# US 10,454,967 B1 · Clustering computer security attacks by threat actor based on attack features > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,967 B1 - Document ID: US10454967B1 - Status: Granted - Kind: B1 - Application number: 14/865,451 - Filed: 2015-09-25 - Granted: 2019-10-22 - Earliest claimed: 2015-09-25 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Alex Zaslavsky; Oren Karmi; Uri Fleyder; Lior Ben-Porat; Marcelo Blatt - Web page: https://patentgrep.com/patent/US10454967B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/554: {involving event detection and direct action} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Clustering is provided of computer security attacks by the threat actor based on features of the attacks. Attack data is obtained for a given attack and a plurality of features of the given attack are extracted from a plurality of attack attributes. A feature-based score is computed for the given attack based on the extracted features relative to each of a plurality of attack clusters. Each attack cluster is comprised of a plurality of attacks performed by a particular attacker. The given computer security attack is assigned to a particular attack cluster if the feature-based score for the particular attack satisfies a predefined score criteria. ## Claims ### Claim 1 A method comprising: obtaining attack data for a given computer security attack; extracting a plurality of features of said given computer security attack from a plurality of attributes of said given computer security attack collected from a plurality of attack attribute sources; computing, using at least one processing device, a feature-based score for said given computer security attack based on said extracted features of said given computer security attack relative to each of a plurality of attack clusters, wherein each attack cluster is comprised of a plurality of attacks performed by a particular attacker; assigning, using said at least one processing device, said given computer security attack to a given attack cluster if said feature-based score for said given computer security attack satisfies one or more predefined score criteria such that said plurality of attack clusters comprises substantially only said plurality of attacks performed by said corresponding particular attacker; and providing, using said at least one processing device, said plurality of attack clusters each substantially comprised of said plurality of attacks performed by said particular attacker. ### Claim 2 (depends on 1) The method of claim 1, wherein said given computer security attack comprises one or more of a malware attack and a phishing attack and wherein said obtained attack data comprises one or more of malware associated with said malware attack and a phishing URL, respectively. ### Claim 3 (depends on 1) The method of claim 1, wherein said attributes of said given computer security attack comprise one or more of a sender email address, a phishing uniform resource locator (URL), email header information, a phishing kit, required phishing input fields; a number of pages on a phishing site; Internet Protocol (IP) address, Internet Service Provider of a URL, location of URL, domain of a URL, hypertext markup language (HTML) records, redirection URL, phishing kit information, drop zone email address, and a suspect IP address. ### Claim 4 (depends on 1) The method of claim 1, wherein said one or more predefined score criteria comprise said feature-based score for said given computer security attack exceeding a predefined threshold. ### Claim 5 (depends on 1) The method of claim 1, wherein said one or more predefined score criteria comprise said feature-based score for said given computer security attack relative to said given attack cluster having a maximum value relative to said feature-based scores for said given computer security attack for said plurality of attack clusters. ### Claim 6 (depends on 1) The method of claim 1, further comprising the step of creating a new attack cluster for said given computer security attack if said feature-based score for said given computer security attack does not satisfy one or more predefined score criteria for said plurality of attack clusters. ### Claim 7 (depends on 1) The method of claim 1, further comprising the step of reevaluating at least a subset of said plurality of attack clusters if said given computer security attack is similar to said subset of attack clusters. ### Claim 8 (depends on 1) The method of claim 1, wherein said feature-based score for said given computer security attack aggregates a feature score for a plurality of said extracted features of said given computer security attack based on a comparison to a corresponding feature of said given attack cluster. ### Claim 9 (depends on 8) The method of claim 8, wherein said feature-based score for said given computer security attack aggregates a feature score for a first group of said extracted features separately from a feature score for a second group of said extracted features. ### Claim 10 (depends on 9) The method of claim 9, wherein a first set of predefined comparison techniques are applied for said first group of extracted features and a second set of predefined comparison techniques are applied for said second group of extracted features. ### Claim 11 A system, comprising: a memory; and at least one processing device, coupled to the memory, operative to: obtain attack data for a given computer security attack; extract a plurality of features of said given computer security attack from a plurality of attributes of said given computer security attack collected from a plurality of attack attribute sources; compute, using at least one processing device, a feature-based score for said given computer security attack based on said extracted features of said given computer security attack relative to each of a plurality of attack clusters, wherein each attack cluster is comprised of a plurality of attacks performed by a particular attacker; assign, using said at least one processing device, said given computer security attack to a given attack cluster if said feature-based score for said given computer security attack satisfies one or more predefined score criteria such that said plurality of attack clusters comprises substantially only said plurality of attacks performed by said corresponding particular attacker; and provide, using said at least one processing device, said plurality of attack clusters each substantially comprised of said plurality of attacks performed by said particular attacker. ### Claim 12 (depends on 11) The system of claim 11, wherein said given computer security attack comprises one or more of a malware attack and a phishing attack and wherein said obtained attack data comprises one or more of malware associated with said malware attack and a phishing URL, respectively. ### Claim 13 (depends on 11) The system of claim 11, wherein said one or more predefined score criteria comprise said feature-based score for said given computer security attack exceeding a predefined threshold. ### Claim 14 (depends on 11) The system of claim 11, wherein said one or more predefined score criteria comprise said feature-based score for said given computer security attack relative to said given attack cluster having a maximum value relative to said feature-based scores for said given computer security attack for said plurality of existing attack clusters. ### Claim 15 (depends on 11) The system of claim 11, wherein said at least one processing device is further configured to create a new attack cluster for said given computer security attack if said feature-based score for said given computer security attack does not satisfy one or more predefined score criteria for said plurality of attack clusters. ### Claim 16 (depends on 11) The system of claim 11, wherein said at least one processing device is further configured to reevaluate at least a subset of said plurality of attack clusters if said given computer security attack is similar to said subset of attack clusters. ### Claim 17 (depends on 11) The system of claim 11, wherein said feature-based score for said given computer security attack aggregates a feature score for a plurality of said extracted features of said given computer security attack based on a comparison to a corresponding feature of said given attack cluster. ### Claim 18 An article of manufacture comprising a non-transitory machine readable recordable medium containing one or more programs which when executed by at least one processing device implement the steps of: obtaining attack data for a given computer security attack; extracting a plurality of features of said given computer security attack from a plurality of attributes of said given computer security attack collected from a plurality of attack attribute sources; computing, using at least one processing device, a feature-based score for said given computer security attack based on said extracted features of said given computer security attack relative to each of a plurality of attack clusters, wherein each attack cluster is comprised of a plurality of attacks performed by a particular attacker; assigning, using said at least one processing device, said given computer security attack to a given attack cluster if said feature-based score for said given computer security attack satisfies one or more predefined score criteria such that said plurality of attack clusters comprises substantially only said plurality of attacks performed by said corresponding particular attacker; and providing, using said at least one processing device, said plurality of attack clusters each substantially comprised of said plurality of attacks performed by said particular attacker. ### Claim 19 (depends on 18) The article of manufacture of claim 18, wherein said given computer security attack comprises one or more of a malware attack and a phishing attack and wherein said obtained attack data comprises one or more of malware associated with said malware attack and a phishing URL, respectively. ### Claim 20 (depends on 18) The article of manufacture of claim 18, wherein said one or more predefined score criteria comprise said feature-based score for said given computer security attack exceeding a predefined threshold. ### Claim 21 (depends on 18) The article of manufacture of claim 18, further comprising the step of reevaluating at least a subset of said plurality of attack clusters if said given computer security attack is similar to said subset of attack clusters. ### Claim 22 (depends on 18) The article of manufacture of claim 18, wherein said feature-based score for said given computer security attack aggregates a feature score for a plurality of said extracted features of said given computer security attack based on a comparison to a corresponding feature of said given attack cluster.